7.3.1 Debsecan

O debsecan efectua uma avaliação de segurança ao sistema e relata vulnerabilidades conhecidas associadas aos pacotes instalado no sistema, notificando o administrador (root) dos resultados.

root@server:~# aptitude install debsecan

Para relatórios mais rigorosos, deverá ser indicada a versão Debian do nosso sistema no ficheiro /etc/default/debsecan:

/etc/default/debsecan

#[...]

# For better reporting, specify the correct suite here, using the code
# name (that is, "sid" instead of "unstable").
SUITE=wheezy

#[...]

O debsecan pode ser configurado para ser executado diariamente através de uma tarefa agendada (cron), sendo os resultados enviados por email ao administrador do sistema (root):

root@server:~# debsecan-create-cron

A tarefa agendada durante a configuração irá enviar uma email ao administrador com o resultado da análise de segurança:

Subject: Debian security status of server
To: root@home.lan
Date: Sun, 26 May 2013 15:44:48 +0100 (WEST)
From: root@home.lan (root)

Security report based on the wheezy release

*** New security updates

CVE-2013-1981 RESERVED
  <http://security-tracker.debian.org/tracker/CVE-2013-1981>
  - libx11-6, libx11-data

CVE-2013-1982 
  <http://security-tracker.debian.org/tracker/CVE-2013-1982>
  - libxext6

CVE-2013-1983 
  <http://security-tracker.debian.org/tracker/CVE-2013-1983>
  - libxfixes3

CVE-2013-1986 
  <http://security-tracker.debian.org/tracker/CVE-2013-1986>
  - libxrandr2

CVE-2013-1987 
  <http://security-tracker.debian.org/tracker/CVE-2013-1987>
  - libxrender1

CVE-2013-1993 
  <http://security-tracker.debian.org/tracker/CVE-2013-1993>
  - libgl1-mesa-dri

CVE-2013-1997 RESERVED
  <http://security-tracker.debian.org/tracker/CVE-2013-1997>
  - libx11-6, libx11-data

CVE-2013-2002 
  <http://security-tracker.debian.org/tracker/CVE-2013-2002>
  - libxt6

CVE-2013-2004 RESERVED
  <http://security-tracker.debian.org/tracker/CVE-2013-2004>
  - libx11-6, libx11-data

# [...]

Opcionalmente, o debsecan também pode ser executado a partir da linha de comandos:

root@server:~# debsecan
CVE-2013-1993 libgl1-mesa-dri (fixed)
CVE-2013-2064 libxcb-shm0 (fixed)
CVE-2013-2494 isc-dhcp-common (low urgency)
CVE-2013-0157 libuuid1 (low urgency)
CVE-2002-2439 cpp-4.6 (low urgency)
CVE-2002-2443 libgssapi-krb5-2
CVE-2013-0157 bsdutils (low urgency)
CVE-2012-3406 libc6-dev (low urgency)
CVE-2012-4412 libc6-dev (low urgency)
CVE-2012-4424 libc6-dev (low urgency)
CVE-2013-0242 libc6-dev (low urgency)
CVE-2013-1914 libc6-dev
TEMP-0708866-B98998 rrdtool
CVE-2002-2443 libk5crypto3
CVE-2013-1982 libxext6 (fixed)
CVE-2013-1987 libxrender1 (fixed)
# [...]

• debsecan